CHFI Practice Test 24 — 15 Questions

Question 1

A forensic examiner is analyzing a RAID 5 array consisting of three disks. One disk has failed and is not available. The remaining two disks contain data and parity. Which technique can be used to reconstruct the missing disk's data and recover the original data?

Accepted Answer

Use dd to image the two disks, then perform a XOR operation on the data stripes to reconstruct the third disk's data. In RAID 5, parity is distributed across all disks. With two disks and one missing, XOR operations can reconstruct the missing data.

Answer

Replace the failed disk and rebuild the array using the controller's rebuild function

Answer

Use FTK Imager to create a logical image of each disk and merge them

Answer

Simply image the two disks and use file carving tools to extract files

Question 2

An investigator is using Autopsy to analyze a disk image from a suspected hacker's computer. They want to recover deleted JPEG images that may have been stored in unallocated clusters. Which Autopsy feature is best suited for this task?

Accepted Answer

File Type Sorting. Autopsy's 'File Recovery by Type' module (also known as 'PhotoRec Carver' or 'File Carving') can recover files based on their headers/footers, such as JPEG magic bytes.

Answer

Hash Set Analysis

Answer

Timeline Analysis

Answer

Keyword Search

Question 3

Which TWO of the following are commonly used tools for file carving (recovering files based on file signatures)? (Select TWO.)

Accepted Answer

Foremost. Foremost and Scalpel are well-known file carving tools that use header/footer signatures to recover files from disk images.

Answer

Nmap

Answer

Wireshark

Answer

John the Ripper

Question 4

During a forensic examination of an NTFS drive, an analyst runs 'fsutil usn readjournal C:' and observes a large number of USN journal entries for a specific file after a certain date. The file's $MFT record shows a last modified timestamp far earlier than the journal entries. What does this discrepancy suggest?

Accepted Answer

The file's metadata was modified without changing its content, possibly using timestomping or ADS manipulation. The USN journal records changes to files. If the journal shows many entries after the last modified timestamp, it indicates that the file was accessed or modified in ways that did not update the $MFT timestamps (e.g., via alternate data streams, timestomping, or changes to metadata). This could be evidence of anti-forensics.

Answer

The file is a system file that is excluded from USN journaling

Answer

The file system is corrupted and the MFT is not updating correctly

Answer

The file was accessed via a mounted volume shadow copy, which does not update MFT

Question 5

Which TWO of the following tools are commonly used for file carving in forensic investigations?

Accepted Answer

PhotoRec. Foremost and PhotoRec are popular file carving tools. EnCase and FTK are suites that include carving but are not exclusively carving tools; the question asks for tools commonly used for carving.

Answer

Autopsy

Answer

EnCase

Answer

Wireshark

Question 6

In an investigation of a Windows system, the analyst uses Volatility's 'netscan' plugin and identifies a suspicious outbound connection to an IP address on port 4444. Which of the following is the most likely associated malicious activity?

Accepted Answer

Reverse shell connection from a backdoor. Port 4444 is commonly used by reverse shells (e.g., Metasploit default) and indicates a potential command and control session.

Answer

DNS tunneling exfiltration

Answer

HTTP data exfiltration

Answer

Remote desktop session

Question 7

An analyst is examining an Apple Mac system and needs to recover deleted files from an APFS volume. Which tool is most appropriate for this task?

Accepted Answer

FTK Imager. APFS is the default file system on modern Macs. Tools like 'foremost' or 'photorec' can carve files from the raw device, but file system aware tools like 'apfs-fuse' or 'disk drill' are more appropriate. Among forensic suites, FTK and EnCase support APFS.

Answer

Foremost

Answer

LiME

Answer

Volatility

Question 8

Which file system uses a Master File Table ($MFT) as its central catalog for file metadata?

Accepted Answer

NTFS. NTFS uses the $MFT to store information about all files and directories on the volume.

Answer

FAT32

Answer

APFS

Answer

ext4

Question 9

An analyst is analyzing a disk image and finds a 512-byte sector at LBA 0 that contains a bootloader and a partition table. The partition table has four entries, each 16 bytes. What type of partition table is this?

Accepted Answer

MBR. The MBR (Master Boot Record) uses a 512-byte sector at LBA 0, with the first 446 bytes for boot code, a 64-byte partition table (4 entries of 16 bytes each), and a 2-byte signature (0x55AA). This description matches MBR exactly.

Answer

Apple Partition Map

Answer

GPT

Answer

BSD disklabel

Question 10

During a forensic analysis of an NTFS volume, an investigator finds a file that appears to be hidden. Which NTFS feature allows data to be stored in a file without affecting the file's visible size in the directory listing?

Accepted Answer

Alternate Data Streams (ADS). Alternate Data Streams (ADS) in NTFS allow data to be attached to a file, and the size is not shown in the main directory listing.

Answer

Volume Shadow Copy

Answer

USN Journal

Answer

Master File Table ($MFT)

Question 11

During a forensic analysis of an APFS volume, the investigator needs to examine file metadata such as creation time, modification time, and extended attributes. Which APFS structure contains this information?

Accepted Answer

Inode Table. In APFS, files and directories are represented by inodes. The inode contains basic metadata. Extended attributes are stored separately in B-tree structures.

Answer

Volume Superblock

Answer

Journal

Answer

Extent Reference Tree

Question 12

A forensic analyst needs to acquire RAM from a live Linux system for memory analysis. Which tool is specifically designed for this purpose and can capture memory without rebooting?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a kernel module that allows acquisition of volatile memory from Linux systems. It loads into the kernel and dumps RAM to a file or over the network.

Answer

FTK Imager

Answer

Volatility

Answer

dd

Question 13

During a forensic analysis of a Windows 10 system, an investigator needs to locate the Master File Table ($MFT) to analyze file metadata. Which file system structure contains the $MFT?

Accepted Answer

NTFS volume's Master File Table. The $MFT is a core NTFS system file that contains metadata for all files and directories on an NTFS volume.

Answer

ext4 superblock

Answer

FAT32's File Allocation Table

Answer

HFS+ catalog file

Question 14

An investigator needs to recover deleted files from a USB drive formatted with FAT32. Which of the following techniques would be most effective, assuming the files have not been overwritten?

Accepted Answer

Examine the FAT for unallocated clusters and reconstruct files. FAT32 stores directory entries that are marked as deleted but still contain file metadata; carving based on remnants of directory entries is effective.

Answer

Check the journal for recent changes

Answer

Analyze the $MFT for orphaned entries

Question 15

During an investigation, an analyst recovers a file from unallocated space that contains fragments of a deleted document. The file size is 512 bytes, but the cluster size of the volume is 4096 bytes. What is the term for the unused bytes between the end of the file and the end of the last cluster?

Accepted Answer

File slack. File slack is the space between the end of the logical file and the end of the last cluster allocated to it.

Answer

Volume slack

Answer

Drive slack

Answer

RAM slack